SL Decryption Exclusions

[roma]

Hi All,

I'm using SSL decryption and if I wanted to have a URL in the exceptions (not decrypted) list, I would add it to a custom url category I created and just add the domain and apply the cutom url to the policy.

But I also noticed that in Device>Certificate Management>SSL decryption exclusion - there are many predefined domains that seem to not be decrypted. If this is the case, why do they have that listed under certificates?

If I add a url to the custom url category I created or the one in certificates, is it the same thing?

Thanks.

[S.Cantwell · Accepted solution]

Use the SSL Decryption List for technical reason (hair pinning, key pinning, client side authentication, etc).
Use a custom URL category for everything else that you do not want decrypted.